Powerforensics on powershell 5

I am trying to get a handle to a locked file in Powershell 5. I tried running the Copy-FileRaw cmdlet from PowerForensics, but get a "Could not find the filerecord requested.." error message. Is PowerForensics supported on Powershell 5?  

Parents
  • PS C:\Windows\system32> Get-FileRecord -Index 0 | select -ExpandProperty Attribute | Where-Object {$_.Name -eq "DATA"}

     

    AllocatedSize   : 441450496

    RealSize        : 441450496

    InitializedSize : 441450496

    DataRun         : {PowerForensics.Ntfs.DataRun}

    Name            : DATA

    NameString      : 

    AttributeId     : 1

     

    The History file had an index # of 335452

Reply
  • PS C:\Windows\system32> Get-FileRecord -Index 0 | select -ExpandProperty Attribute | Where-Object {$_.Name -eq "DATA"}

     

    AllocatedSize   : 441450496

    RealSize        : 441450496

    InitializedSize : 441450496

    DataRun         : {PowerForensics.Ntfs.DataRun}

    Name            : DATA

    NameString      : 

    AttributeId     : 1

     

    The History file had an index # of 335452

Children
No Data